On 21 September 2026, the Data Protection Commission (“DPC”) issued its final decision following an Inquiry into Google Ireland Limited (“Google”). This decision marks the fourth-largest penalty issued by the DPC under the General Data Protection Regulation (“GDPR”). The DPC launched its own-volition Inquiry in its role as the Lead Supervisory Authority for Google, in February 2020, following receipt of complaints from several European consumer rights organisations, regarding Google’s processing of location data in connection with certain services and products.

The scope of the Inquiry concerned data processing activities occurring between 25 May 2018 and 4 February 2020. The Inquiry focussed on three specific features;

1. Web & App Activity
2. Location History
3. Location Accuracy.

The Inquiry concluded that the methods used to track, process and store user locations during this period failed to satisfy the GDPR requirements of lawfulness, fairness, and transparency.

The DPC found that Google infringed the GDPR in respect of:

• The lawfulness and fairness of its processing of location data in Web & App Activity and Location History
• Its accountability obligations under the GDPR by failing to demonstrate compliance with the lawfulness, fairness and transparency principles regarding its processing of personal data in Location Accuracy. The Inquiry highlighted that for a feature like Location Accuracy, which functions even in the absence of a registered user profile, the data controller failed to adequately demonstrate compliance with those principles
• Its transparency obligations in respect of all three features. Central to the DPC’s decision was the finding that the historical processing of location data left users fundamentally unaware of how and why their geographical location was being tracked for behavioural profiling or ad targeting
• Its retention of location data in Web & App Activity and Location History. The Inquiry found that Google retained location history logs longer than was legally justifiable or necessary for the original purposes of service delivery, although the DPC’s public summary does not state that the period was “significantly” longer.

In its defence, Google argued that the investigation focused entirely on historical policies and that substantial updates to user privacy had been introduced from 2019 onward. The DPC highlighted that subsequent technical patches will not retrospectively cure past breaches of the GDPR. The DPC ultimately imposed administrative fines totalling €403 million and has ordered Google to bring its processing into compliance within six months. We expect the DPC to issue its full decision in due course.